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The Information Commissioner’s response to HMRC public consultations and 
discussion documents: 

e The tax administration framework: Supporting a 21st century tax system: 
Call for evidence 
Clamping down on promoters of tax avoidance: Consultation 
Helping taxpayers get offshore tax right: Discussion document 
Preventing and collecting international tax debt: discussion document 
Raising standards in the tax advice market: professional indemnity 
insurance and defining tax advice: Consultation 


Response to each of the above can be found in following document (see 
successive headers): 


About the ICO 


The Information Commissioner has responsibility for promoting and enforcing the 
UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 
(DPA), the Freedom of Information Act 2000 (FOIA), the Environmental 
Information Regulations 2004 (EIR) and the Privacy and Electronic 
Communications Regulations 2003 (PECR). She is independent from government 
and upholds information rights in the public interest, promoting openness by 
public bodies and data privacy for individuals. The Commissioner does this by 
providing guidance to individuals and organisations, solving problems where she 
can, and taking appropriate action where the law is broken. 


Introduction 


The Information Commissioner's Office (ICO) welcomes the opportunity to 
respond to HMRC’s public consultations which follow up on its ten year strategy 
entitled ‘Building a trusted, modern tax administration system.’ As several of the 
resulting consultations raise issues with common themes, the ICO has elected to 
provide a single response. Although our comments appear in relation to specific 
consultations, the principles we refer to, especially those relating to any data 
sharing, are of general application. 
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The tax administration framework: Supporting a 21st century tax system: Call 
for evidence 


The ICO recognises the statutory responsibilities that HMRC has in administering 
our tax system, including properly collecting revenue and making payments to 
ensure that everyone pays the right amount of tax. These also include driving 
efficiencies and being flexible to respond to the needs of a modern tax system. It 
is well understood that HMRC requires detailed and accurate financial and other 
information about taxpayers to carry out its functions. Taxpayers may provide 
much of this information themselves, but HMRC also relies on information that it 
receives from other sources, such as agents, employers and other tax 
authorities. 


Given these factors, maintaining the public’s trust and confidence is vital and is 
recognised in HMRC’s call for evidence on its tax administration framework. 
This trust and confidence is likely to be maintained when data is shared 
legitimately and responsibly. 


The ICO welcomed the opportunity to engage with the Office for Tax 
Simplification (OTS) earlier this year during the OTS’ consultation on the 
potential for the use of smarter use of third party data! in which we highlighted 
the importance of embedding data protection principles into any potential third 
party data sharing. Data protection legislation is not a barrier for sharing 
arrangements that are fit for purpose, that ensure that the data sharing is 
necessary and proportionate, and that uphold individuals’ rights. 


Therefore when exploring any proposals for data sharing, such as using personal 
data from third parties more extensively, for example, to pre-populate tax 
returns, HMRC will need to take account of the ICO’s data sharing code of 
practice which was laid in Parliament on 18 May 2021.2 The ICO has also 
published a range of additional resources on its data sharing hub?, which is 
expected to expand over coming months. 


The ICO would be pleased to engage with HMRC as it develops its policies 
involving the use of personal data after the present public consultation. 


1 Making tax easier through smarter use of third party data - GOV.UK (www.gov.uk) 
? Data sharing: a code of practice | ICO 
3 Data sharing information hub | ICO 
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Clamping down on promoters of tax avoidance: Consultation 


HMRC is presently consulting on how it can alert taxpayers to tax avoidance 
schemes*. We acknowledge that there is a public interest in protecting taxpayers 
from engaging with schemes which might expose them to risk. 


It is proposed that HMRC will publish the name and details of schemes and 
relevant promoters in circumstances where HMRC suspect they are tax avoidance 
schemes and have begun their investigations. 


Publication in the circumstances envisaged could be prejudicial and adversely 
impact on individuals, especially as it would take place before the investigation 
has concluded or findings made against the promoters concerned, and indeed, 
HMRC may conclude that the schemes under investigation are not tax avoidance 
schemes. 


The ICO therefore welcomes the approach that HMRC has already taken in 
preparing a Data Protection Impact Assessment (DPIA) for the proposals in this 
consultation and which sets out proposed safeguards. These include an intention 
on the part of HMRC to publish only after the promoter has had an opportunity to 
make representations about publication. Furthermore, HMRC intends to adopt a 
case by case approach, involving HMRC’s own internal governance process which 
would require the agreement of solicitors and that of a senior independent officer 
to publication. The promoter will also have a right to appeal against any decision 
to publish. HMRC will nonetheless need to consider the necessity and 
proportionality of publication in each case, which will include taking account of 
the potential impact on the individual, as well as any public interest in 
publication. 


HMRC will also need to consider the necessity and proportionality of any 
proposed targeted sharing, whether with users of schemes that are under 


investigation or others, and assess any additional risks and possible mitigating 
measures in doing so, which it should set out in its DPIA. 


A Clamping down on promoters of tax avoidance: Consultation 
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Furthermore, given the potential impact on individuals as a result of publication, 
especially if HMRC were to conclude that the scheme is not a tax avoidance 
scheme, HMRC could usefully clarify its process for ensuring that the information 
on the published list of ongoing enquiries is kept up to date. At present, HMRC 
proposes to confirm that the list is correct once a year. It also suggests that if it 
concludes that a scheme is not a tax avoidance scheme, it will remove the details 
at the earliest opportunity. HMRC will however need to consider whether 
additional communications might be required, especially if it had proactively 
shared information with users at an earlier stage to tell them that a scheme was 
under investigation. 


When considering the steps that HMRC might take in publicising the names of 
promoters of tax avoidance schemes, whether on a published list or in any other 
manner, HMRC will need to consider whether this sharing of personal data might 
amount to an international transfer. The ICO has published guidance? which 
explains various safeguards which might be employed, as there are only limited 
exceptions on which an organisation might rely. In particular, the exception 
which allows such transfers for important reasons of public interest should not be 
used for systematic transfers. In the absence of any of the specified safeguards, 
HMRC should therefore only rely on this exception in specific situations, and each 
time HMRC will need to be satisfied that the transfer is necessary for an 
important reason of public interest. 


HMRC should ensure that it keeps its DPIA under review. In particular, it will 
need to set out its assessment of any material changes or developments in the 
proposals as they arise throughout the development of this policy, including any 
amendment to the risks identified and the mitigating steps that HMRC plans to 
take to address them. 


5 International transfers after the UK exit from the EU Implementation Period | ICO 
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Helping taxpayers get offshore tax right: Discussion document 


HMRC is considering contacting individual taxpayers and their agents or 
intermediaries to deliver reminders that the taxpayer has known offshore assets 
which will need to be included in their upcoming tax return. 


HMRC will need to be look carefully at the source of the information it might rely 
on to ‘pre-select’ taxpayers for such reminders to ensure that it has been shared 
lawfully and appropriately with HMRC. This might be particularly important in the 
context of information supplied to HMRC where a financial institution did not 
exercise its discretion to apply certain exemptions and thresholds when 
complying with its reporting obligations. 


HMRC will also need to consider carefully the lawful basis for processing that it 
might rely on for any sharing of personal data in these circumstances. This 
should form part of HMRC’s assessment of the necessity and proportionality of 
the sharing, which should also include safeguards to protect taxpayers from 
inappropriate disclosures and communications. In particular, any safeguards will 
need to address situations such as where an agent ceases to act for the 
taxpayer. HMRC might also usefully consider how it could deliver messages of 
this nature in ways that do not disclose any personal data. 


Preventing and collecting international tax debt: discussion document 


HMRC has put forward the possibility of using personal data received from other 
tax authorities, for example, under the international Common Reporting Standard 
(CRS) exchange of information agreement to assess if a taxpayer has the means 
to pay their international tax debt. It is also considering whether such data can 
be combined with other data to identify professions, activities or jurisdictions 
with a higher risk of creating this kind of debt. 


As mentioned above, in relation to ‘Helping taxpayers get offshore tax right’, 
HMRC will need to assess carefully the sources of the information it relies on 
when considering a taxpayer’s means to pay. This will form part of its 
assessment of the proportionality of any action HMRC might take in reliance upon 
it. HMRC will also want to take account of the provisions in UK GDPR regarding 
profiling and automated decision making and the ICO’s guidance in this respect.® 


6 What is automated individual decision-making and profiling? | ICO 
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Raising standards in the tax advice market: professional indemnity insurance 
and defining tax advice: Consultation 


HMRC intends to require tax advisers to carry professional indemnity insurance 
and wants to ensure that individuals can check on the insurance status of their 
adviser. HMRC will need to ensure that any personal data shared on any portal 
accessible by the tax payer (or more widely) about the insurance status of tax 
advisers is limited to what is necessary and proportionate. 


HMRC will also need to consider the circumstances in which personal data 
relating to tax advisers who do not comply with requirements for insurance will 
be published. HMRC will also need to ensure that the information on which it 
intends to rely is accurate and up to date. 


Future engagement 


We welcome the opportunity to engage with HMRC in the development of its 
policy proposals arising under any of the present consultations and discussions 
papers which fall within the remit of the ICO. 


We also look forward to meaningful consultation with HMRC under Article 36(4) 
UK GDPR in respect of any future legislative proposals involving the processing of 
personal data. The requirement for consultation under this provision is a 
continuing obligation which should be kept under review. We therefore welcome 
the opportunity to engage further with HMRC on its proposals to clamp down on 
the promoters of tax avoidance which has already been referred to us, if there 
should be any material change to the proposed policy after the public 
consultation responses have been considered. 


June 2021 
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